The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Small businesses cannot prevent every attack, and not every attack uses artificial intelligence. They can, however, make the most damaging scams much harder to complete. The practical formula is to independently verify high-impact requests, use phishing-resistant multi-factor authentication (MFA), authenticate the company email domain, patch and replace unsupported systems, maintain tested backups, monitor important activity, and rehearse who responds when something goes wrong.
AI mainly changes the attacker’s speed, scale and realism. It can produce polished phishing messages, imitate a manager’s writing style or help clone a voice. Those capabilities strengthen familiar fraud techniques; they do not make established security controls obsolete. A small firm should therefore treat AI risk as part of a broader security program rather than shop for one “AI defense.”
As an Amazon Associate I earn from qualifying purchases.
What AI changes about attacks on small businesses
Generative tools can remove many of the clues people traditionally used to spot a scam. A message can have fluent grammar, plausible business context and a tone that resembles an executive or supplier. A criminal can also create more variations of a campaign and target more employees at once. NIST’s March 2024 small-business phishing fact sheet warns that AI can craft increasingly convincing phishing attacks and urges people to take a second or third look before clicking a link, downloading a file, transferring funds, logging in or submitting sensitive information.
The FBI’s 2025 Internet Crime Complaint Center (IC3) Annual Report, published in 2026, describes business email compromise (BEC) schemes in which chat generators produce official-sounding messages that mimic company leaders. The report also describes voice cloning used to request wire payments. Businesses reported more than $30 million in losses from BEC scams involving AI in 2025. That figure covers the reported AI-involved BEC category for that year; it is not total cybercrime, all BEC, or a measure of every small business’s exposure.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
AI involvement is often impossible to prove from a single message. The safer question is whether the requested action is consequential and whether it can be verified through a channel the requester did not control.
How can small businesses reduce the risk of AI-powered cyberattacks?
1. Pause and independently verify consequential requests
Require a second-channel check for requests involving money, credentials, sensitive data, new bank details, gift cards, payroll changes, urgent file transfers or privileged access. Call a known number from an existing vendor or employee record, or start a new message using a previously trusted address. Do not use the phone number, reply address or link supplied in the unexpected request.
For a changed payment instruction, have two people approve the change where practical: one verifies the request with the established contact and another confirms the transaction details. A familiar writing style, a copied signature or a convincing voice is not proof of identity. If a voice call seems unusual, end it and call the person back through the number already on file.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute2. Make reporting quick and blame-free
Give every employee a simple route to report a suspicious message, including a case in which they already clicked or disclosed information. A fast report can allow the business to revoke a session, reset credentials, warn a bank or stop a payment. Explain that early reporting is expected and will not be punished; hiding a mistake gives an attacker more time.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Protect the accounts attackers want most
Enable MFA first on business email, cloud file storage, remote access, banking and payment services, and administrator accounts. Use unique passwords for each service. A password manager can help staff avoid reuse, but it supports MFA rather than replacing it.
CISA’s small-business guidance ranks common MFA methods by resistance to phishing. A physical security key is the strongest option listed when the account and device support it. Next are an authenticator app with number matching, an authenticator app that generates a one-time code, and biometrics used with another method. Text-message or email codes are weaker because attackers can intercept or redirect them, but they are generally preferable to no MFA when stronger methods are unavailable.
| MFA method | Relative protection in CISA’s hierarchy | Implementation considerations |
|---|---|---|
| Physical security key | Strongest listed option | Check support for each email, cloud, financial and remote-access account; document spare-key and recovery procedures. |
| Authenticator app with number matching | High | Staff approve a sign-in by matching a displayed number; protect the enrollment and recovery process. |
| Authenticator app one-time code | Moderate to high | Codes are stronger than SMS or email, but a user can still be tricked into entering one on a fake site. |
| Biometrics with another method | Useful when combined | Use as part of a broader sign-in method rather than relying on it alone. |
| Text or email code | Weakest listed option | Use only when stronger choices are not supported, and plan a move to a more phishing-resistant method. |
Before buying security keys, confirm that every critical provider supports the same standard and that employees have a documented way to recover an account if a key is lost. A key does not stop a scammer from persuading an authorized user to approve an unrelated transaction.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How to reduce forged and impersonated business email
Configure SPF, DKIM and DMARC
Ask the company’s email or domain provider, or the IT administrator, whether Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC) are configured for every business domain that sends mail.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- SPF publishes which mail servers are allowed to send for the domain.
- DKIM adds a cryptographic signature that receiving systems can check.
- DMARC tells receiving systems how to handle messages that fail alignment checks and supplies reporting about apparent misuse.
These controls help a recipient distinguish an unauthorized sender using your domain from legitimate mail. They do not prove the intent of a real employee whose account has been compromised, so domain authentication must accompany MFA, account monitoring and payment verification.
Protect supplier and executive workflows
Maintain an approved contact record for vendors, payroll providers, banks and executives. Require a call-back through that record whenever an account number, payment destination or urgent approval changes. For high-value transfers, set a dollar threshold that requires a second approver and a waiting period unless a documented emergency process is followed.
Keep devices, applications and suppliers harder to exploit
Patch and retire unsupported systems
Install current operating-system, application, browser, router and security updates. Enable automatic updates where they will not disrupt a critical workflow, and establish a schedule for the systems that require manual testing. Replace or isolate products that no longer receive security fixes. Attackers may use AI to discover targets or personalize messages, but an unpatched internet-facing system remains a conventional and highly valuable entry point.
Limit administrative access
Review who can install software, change email settings, create accounts or access customer and financial data. Remove access that is no longer needed, separate administrator accounts from everyday accounts, and review dormant accounts after staff, contractor or supplier changes. Ask technology providers how they protect their own administrative access and customer data; a supplier’s compromise can become your incident.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Secure remote work and external services
Require MFA for remote-access tools and cloud consoles, restrict access to the countries, networks or devices appropriate for the business, and disable services that are not used. Keep an inventory of critical providers, data they hold and the person responsible for contacting each one during an outage or breach.
Make business data recoverable after an intrusion
Back up what the business cannot recreate
Identify the files and configurations needed to run payroll, serve customers, deliver orders and restore core systems. Back them up on a schedule that matches how much data the business can afford to lose. Keep at least one copy separated from ordinary user accounts or network systems so ransomware or stolen administrator credentials cannot erase every copy.
Test restoration, not just backup jobs
A “successful” backup task does not guarantee that files can be restored. At set intervals, restore representative files and, where practical, a complete system to a clean environment. Record how long restoration takes, who has the credentials and whether the restored data is complete and usable. Update the procedure when applications, suppliers or account permissions change.
Detect unusual activity and prepare an incident response
Start monitoring where a compromise would hurt most
Enable available logs and alerts for email sign-ins, MFA changes, new forwarding rules, administrator actions, remote access, large downloads and payment-system activity. A small organization can begin with email, payroll, customer-data stores and operational systems rather than trying to collect everything. Restrict who can view logs and protect them from alteration or deletion; otherwise an intruder may be able to hide the evidence.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Assign responsibilities before an emergency
Write down who performs technical containment, who contacts the bank and insurers, who communicates with employees and customers, and who keeps essential operations running. Include contact details for the IT provider, domain and email provider, critical suppliers and legal counsel. Decide who can disable an account, isolate a device and pause a payment.
Use a simple response sequence
- Contain: stop suspicious sessions, disable affected accounts, isolate compromised devices and preserve relevant logs.
- Protect funds and data: contact the bank immediately about a suspected fraudulent transfer, change credentials from a known-clean device and warn recipients of malicious messages.
- Assess: determine which accounts, systems and data were accessed, and whether an attacker still has persistence.
- Recover: rebuild or restore from verified backups, apply missing patches and re-enroll MFA where necessary.
- Notify and learn: document the timeline, meet reporting obligations and update controls based on what failed.
The FTC advises reporting cyberattacks to the FBI and appropriate regulators. Which reports are required, and how quickly, depends on the incident, industry, contracts and jurisdiction. Confirm the applicable rules with qualified legal or regulatory advisers rather than assuming one U.S. deadline applies to every business.
Use a framework to prioritize limited time and budget
The FTC’s overview of NIST Cybersecurity Framework 2.0 organizes security work into six functions:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Function | Small-business question | Near-term examples |
|---|---|---|
| Govern | Who owns risk decisions and obligations? | Assign an owner, approve verification rules and record supplier and regulatory responsibilities. |
| Identify | What assets, data and services matter most? | Inventory email, payment, payroll, customer-data and remote-access systems. |
| Protect | Which safeguards prevent or limit an incident? | Deploy MFA, unique passwords, domain authentication, patches, least privilege and backups. |
| Detect | How will the business notice suspicious activity? | Review sign-in, forwarding, administrator and payment alerts; secure the logs. |
| Respond | What happens during an incident? | Use the call tree, contain accounts and devices, preserve evidence and contact the bank. |
| Recover | How will essential operations resume? | Restore tested backups, rebuild systems and revise procedures after the event. |
Choose the order by business impact, likely threat, legal or contractual duties, existing capability and implementation effort. A five-person firm may begin with email MFA, payment verification and tested backups; a company that develops an AI product may need additional controls for its models and training data.
When a business builds or deploys AI systems
NIST’s 2025 adversarial machine-learning report covers evasion, poisoning, privacy and misuse attacks affecting AI systems, along with mitigations and their limits. Those categories are most directly relevant to organizations that design, develop, deploy, evaluate or govern AI. A business that merely uses an AI-enabled office service does not automatically face every category, but it should still ask the provider what data is retained, who can access it, how accounts are secured and how incidents are reported.
Do not paste customer secrets, credentials, payment information or regulated data into an AI service unless the business has approved that use and understands the provider’s controls. Restrict access to AI workspaces, log administrative actions and review outputs before they trigger payments, legal commitments, security changes or disclosure of sensitive information.
A practical 30-day starting plan
- Days 1–5: list the accounts that control email, money, customer data and administration; turn on the strongest available MFA and remove unused accounts.
- Days 6–10: publish a written rule for verifying payment and credential requests; add a second approver for high-impact changes; tell staff how to report suspected phishing.
- Days 11–15: ask the domain provider about SPF, DKIM and DMARC; review forwarding rules and administrator permissions.
- Days 16–20: inventory internet-facing and unsupported systems, install current updates and schedule replacements or isolation for systems that cannot be patched.
- Days 21–25: confirm that critical data is backed up separately from ordinary accounts and perform a restoration test.
- Days 26–30: enable priority logs and alerts, finalize the incident contact list and run a short exercise involving a fake urgent payment request and a compromised mailbox.
CISA provides free small-business cybersecurity materials and cyber-hygiene resources, although pages, programs and eligibility can change. Check CISA directly for current availability and adapt the guidance to the business’s country, industry and contracts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
